Category Archives: Security

Introducing fsstat

fsstat is part of The Sleuth Kit, which we’ve discussed installing on a Mac OS X system.

Revisiting Various Bytes

This is the last post (hopefully) on our walk through the boot sector. There are couple byte ranges I want to briefly discuss, so I’m grouping them all into the final post. For reference, here’s our ever-present hex editor screenshot.

Revisiting Bytes 17 and 18

This is an important difference between FAT12/FAT16 and FAT32. In FAT12 and FAT16, the beginning of the data area is reserved for the root directory. In FAT32, the root directory can be located anywhere in the data area.

Revisiting Bytes 14-15 and 16

A FAT file system contains a FAT Area. This is the File Allocation Table area. For now, think of the FAT Area as a list of file names and pointers to the Data Area, and think of the Data Area as the place where a file’s content actually resides. So, we’ve got our boot sector, followed by a list of file names which point to that particular file’s content.

Revisiting Bytes 11-12 and 13

Bytes 11-12 give the number of bytes per sector. Byte 13 gives the number of sectors per cluster.